Verify a certificate
Holding a data erasure certificate from reCore? Check that it is genuine and still in force. You need the certificate id and the verification code printed on it. Scanning the QR code fills both in for you.
Check one certificate
Type in what is printed on the certificate.
Both are printed on the certificate. The code is the one labelled “Verification code”. Spaces and dashes in it do not matter.
Check many at once
Received a lot of drives? Paste the list, or upload a CSV, and check them all together.
Write the id, then the code, separated by a space, a comma or a tab. A header row is fine. You can also upload a CSV file with the same two columns.
Nothing to check yet.
How this works
When a certificate is issued, reCore takes a fingerprint of it. A fingerprint is a short value worked out from every detail on the certificate. Change one detail and the fingerprint changes. The verification code is the first 16 characters of that fingerprint.
The certificate is also signed with an Ed25519 digital signature. Only the issuing service holds the private key, so only it can make a valid signature. Anyone can check one with the public key.
When you run a check, the record is read again, its fingerprint is worked out again, and its signature is checked again. You also see whether the issuer has since revoked the certificate or replaced it with a newer one. An id with the wrong code gets the same answer as an id that does not exist, so this page never reveals which certificates exist.
A check tells you one thing: the certificate matches the record its issuer holds, and that record is still in force. It does not inspect the drive itself. Compare the drive serial on the result with the drive in front of you.
To check a signature yourself, offline, the public keys are published at recore.replugit.com/api/public/certificates/signing-keys. Each key is 32 bytes in base64, with the key id printed on the certificate.